# MA-834.052022: MyCERT Alert - SMSSpy campaign to steal Malaysian banking user credential

**Date:** 07 Jun 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-834.052022  
**Advisory ID:** MA-834.052022

---

**1.0 Introduction**
MyCERT observed cybercriminals had exploited a malicious android application in a SMSSpy campaign targeting internet users in Malaysia. The first campaign is leveraging on Law Enforcement Agency (LEA) and regulators. The target victim received a phone call from LEA informing them that they have arrears for their company or are subjected to crime and need to freeze their financial account. The victim will need to pay a sum of money to unfreeze the account and is instructed to download a malicious android application to complete the process of payment.
In the second campaign, threat actors attempt to steal financial credentials by using fake websites that pose as legitimate services, often outright replicating the original. In their effort, threat actors employ Facebook adverts to persuade potential victims to download Android malware from a malicious website. All eight websites impersonated services only in Malaysia: seven of them, Grabmaid, Maria's Cleaning, Maid4u, YourMaid, Maideasy, MaidACall and MyMaidKL, provide cleaning services, and the eight, PetsMore, is a pet store. To tempt potential victims, threat actors set up these websites using domain names similar to their impersonating services.
**2.0 Impact**
Financial lost and disclosure of personal information.
**3.0 Affected System and Devices**
Android.
**4.0 Other 
Below are references of similar incidents:
• [MA-790.072020: MyCERT Alert - SMSSpy using Malaysian Law Enforcement as theme](https://www.mycert.org.my/portal/advisory?id=MA-790.072020)
• [MA-695.012018: MyCERT Alert - Fake Bank Negara Malicious APK - New Variant](https://www.mycert.org.my/portal/advisory?id=MA-695.012018)
• [MA-694.012018: MyCERT Alert - Fake Bank Negara Malicious APK](https://www.mycert.org.my/portal/advisory?id=MA-694.012018)
**5.0 Indicator of Compromised*Table 1: List indicator of compromise for LEA campaign*
|  | --- | --- | **Indicators** | **Indicator type** | **191.apk** 849d69c1f9d370f953ac99a7e96029f350dd6d02fbc21611ae610679e67f0c9f  **base.apk** c527f89bbbea34cce21a558dbc4ddcf88570b54dc887c8f8b44f5647ef061acc c6cc383f1f6aa8b70e39ee60d95344b2f28ada02f5a47fb3d30912538738bb19 *c6e6066b7da082d6a8e8171e1901eea9cd18c9aaff2d1fb4062adef8ce0551c3*110.apk** fc9d34436b4711d6f586903d07a99b089ca5aa61f931febd57abba9a7135d98d | apk, SHA256 | 139.162.61.96 | IP |
*Table 2: List indicator of compromise for cleaning services campaign – IP address*
|  |
| --- | --- | --- | **IP** | **Provider** | **Details** | 185.244.150[.]159 | Dynadot | token2[.]club Distribution website | 194.195.211[.]26 | Hostinger | grabamaid-my[.]online Distribution website | 172.67.177[.]79 | Hostinger | maidacalls[.]online Distribution website | 172.67.205[.]26 | Hostinger | petsmore[.]online Distribution website | 172.67.174[.]195 | Hostinger | cleangmy[.]site Distribution website | N/A | Hostinger | my-maid4us[.]site Distribution website | N/A | Hostinger | yourmaid[.]online Distribution website | 194.195.211[.]26 | Hostinger | muapks[.]online C&C server | 194.195.211[.]26 | Hostinger | grabsapks[.]online C&C server | 104.21.19[.]184 | Hostinger | grabmyapks90[.]online C&C server | 104.21.29[.]168 | Hostinger | m4apks[.]online C&C server | 172.67.208[.]54 | Hostinger | maid4uapks90[.]online C&C server | 172.67.161[.]142 | Hostinger | grabmaidsapks80[.]online C&C server | 2.57.90[.]16 | Hostinger | puapks[.]online C&C server | 124.217.246[.]203 | Shinjiru | 124.217.246[.]203:8099 C&C server | 172.67.166[.]180> | Hostinger | meapks[.]xyz C&C server |
*Table 3: List indicator of compromise for cleaning services campaign – Hash value, domain*
|  | --- | --- | **SHA-256** | **Description** | 9b4a0019e7743a46b49a4d8704ffd6e064db2e5d8db6da4056f7eae5369e16f9  **C&C:** muapks[.]online | Malicious app impersonating Grabmaid service. | e949bac52d39b6e207a7943ec778d96d8811fb63d4a037f70e5b6e6706a12986  **C&C:** m4apks[.]online | Malicious app impersonated Maria’s  Cleaning service. | d1017952d1ef0ceec6c2c766d2c794e8cc4fb61b2ffa10ed6b6228e8cadf0b39  **C&C:** maid4uapks90[.]online | Malicious app impersonating Maid4u service. | 5f8a54d54e25400f52ce317bfdbbc866e11ea784ab2d5e3bd0a082a53c6b2d7b  **C&C:** grabsapks[.]online | Malicious app impersonating MaidACall service. | d8be8f7b8b224fca2bb3e7632f6b97b67a74202dc4456f8a79a8856b478c0c6e  **C&C:** grabmyapks90[.]online | Malicious app impersonating MaidACall service. | a5c7373be95571418c41af0de6a03ce78e82bc1f432e662c0dc42b988640e678  **C&C:** m4apks[.]online | Malicious app impersonating PetsMore service. | dff93fd8f3bc26944962a56cb6b31246d2121ae703298a86f20ea9e8967f6510  **C&C:** m4apks[.]online | Malicious app impersonating PetsMore service. | a091b15f008b117167a17a8db4c19e60bd9c99f1047bc82d60e3fd42157333ae  **C&C:** grabmaidsapks80[.]online | Malicious app impersonating YourMaid service. | 4904c26e90dc4d18ad6a2d291af2cd61390661b628f202abfeddf8056502f64a  **C&C:** 124.217.246[.]203:8099 | Malicious app impersonating Maid4u service. | 6db2d526c3310fad6c857aa1310f74dc0a5fe21402e408937330827aca2879b7  **C&C:** meapks[.]xyz | Malicious app impersonating Maideasy service. | **mymaid\_beta\_v7.0.5.2.apk** 8bc920af87fa19c3bfe76b40f85390d983b81340af690a49113f247cca957456  **URL:** hxxps://api.lapubo[.]com hxxps://mymaidkl[.]com hxxps://mobile666.mymaidkl[.]com  **Phone Number** +60172675873 | Malicious app impersonating MyMaidKL service. |
**6.0 Recommendations**
The application is meant to retrieve information in victim’s phone and could be used for other malicious purpose. As CERT, we would highly recommend the followings:
• Verify an application permission and the application author or publisher before installing it.
• Avoid side loading (installing from non-official sources) when you can. If you do need to install Android software from a source other than the trusted marketplace, be sure that it is coming from a reputable source.
• Do not click on adware or suspicious URL sent through SMS/messaging services.
• Malicious program could be attached to collect user's information.
• Always run a reputable anti-virus on your smartphone/mobile devices, and keep it up to date regularly.
• Update the operating system and applications on smartphone/tablet, including the browser, in order to avoid any malicious exploits of security holes in out-dates versions.
• Do not root or 'Jailbreak' your phone.
• Contact relevant authorities such as Cyber999 for any inquiries and assistance needed 
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**7.0    References**
1. MA-790.072020: MyCERT Alert - SMSSpy using Malaysian Law Enforcement as theme
<https://www.mycert.org.my/portal/advisory?id=MA-790.072020>
2. MA-690.122017: MyCERT Alert - Fake PDRM Malicious APK
<https://www.mycert.org.my/portal/advisory?id=MA-690.122017>
3. MA-695.012018: MyCERT Alert - Fake Bank Negara Malicious APK - New Variant
<https://www.mycert.org.my/portal/advisory?id=MA-695.012018>
4. MA-694.012018: MyCERT Alert - Fake Bank Negara Malicious APK
<https://www.mycert.org.my/portal/advisory?id=MA-694.012018>
5. <https://www.virustotal.com/gui/ip-address/139.162.61.96/relations>
6. <https://www.virustotal.com/gui/file/fc9d34436b4711d6f586903d07a99b089ca5aa61f931febd57abba9a7135d98d/relations>
7. <https://twitter.com/esetresearch/status/1526440685460672512?s=24&t=xveoIxTaZLIdhpnzy-YSag>
8. <https://www.welivesecurity.com/2022/04/06/fake-eshops-prowl-banking-credentials-android-malware/>
9. <https://notes.netbytesec.com/2022/05/scam-and-malicious-apk-targeting.html>